Home page logo
/

pen-test logo Penetration Testing mailing list archives

[PEN-TEST] Hard-coded passwords in WINNT directory?
From: Jonathan Wrathall <JWrathall () JAWZINC COM>
Date: Mon, 27 Nov 2000 15:23:42 -0700

During a test of a client's IIS web server, I've encountered the following
scenario:

1.  I am able to view files in the WINNT directory using the "MS Index
Server '%20' ASP Source Disclosure Vulnerability" vulnerability.

2. I am able to connect to IPC$, and I've used dumpsec to get the userlist
etc.

3. The winnt/system32/repair/sam._ file does not appear to be present.

Can anyone suggest other files that might reveal hard-coded passwords, or
other valuable information?

Thanks,
Jon
_________________________________________________
Jonathan Wrathall, BCom
Security Consultant
JAWZ Inc.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault